Full Report
Pegasus infects mobile devices through zero-click exploits and silently harvests messages, calls, location, and microphone access. Learn how the spyware operates and the steps security teams can take to detect it on iOS and Android.
Analysis Summary
# Tool/Technique: Pegasus Spyware
## Overview
Pegasus is a highly sophisticated, military-grade spyware suite developed by the NSO Group. It is designed to be covertly installed on mobile devices to provide remote operators with near-complete access to the victim’s data and sensors. It is primarily known for its use of "zero-click" exploits, which allow for infection without any user interaction.
## Technical Details
- **Type:** Malware Family / Spyware Framework
- **Platform:** iOS, Android
- **Capabilities:** Data exfiltration, environmental monitoring, remote surveillance, self-destruction/obfuscation.
- **First Seen:** Approximately 2016 (though it has undergone numerous iterations).
## MITRE ATT&CK Mapping
- **[TA0027 - Initial Access]**
- [T1475 - Drive-By Compromise]
- [T1629.001 - Exploit via SMS/MMS]
- **[TA0029 - Persistence]**
- [T1398 - Boot or Logon Initialization Scripts]
- **[TA0030 - Privilege Escalation]**
- [T1404 - Exploitation for Privilege Escalation]
- **[TA0032 - Credential Access]**
- [T1409 - Access Stored Application Data]
- **[TA0035 - Collection]**
- [T1430 - Location Tracking]
- [T1512 - Screen Capture]
- [T1429 - Audio Capture]
- **[TA0037 - Command and Control]**
- [T1417 - Standard Application Layer Protocol]
## Functionality
### Core Capabilities
- **Comprehensive Data Exfiltration:** Harvests SMS messages, emails, WhatsApp/Signal chats, contact lists, and call logs.
- **Sensor Control:** Remotely activates the microphone and camera to eavesdrop on conversations and surroundings.
- **Location Tracking:** Real-time monitoring of GPS coordinates and cell tower data.
- **Browser History:** Accesses web history and search queries.
### Advanced Features
- **Zero-Click Exploitation:** Can infect devices through hidden push notifications or malicious messages (e.g., via iMessage or WhatsApp) that do not require the user to click a link.
- **Stealth and Self-Destruction:** Pegasus is designed to leave a minimal footprint. It can uninstall itself if it detects it is being analyzed or if it loses contact with the C2 server for an extended period.
- **Persistence:** High-level persistence that can survive standard reboots; however, it often resides in volatile memory or system partitions to avoid detection by standard file scanners.
## Indicators of Compromise
*Note: Indicators change frequently due to NSO Group infrastructure updates.*
- **File Hashes:** Specific hashes vary per version (refer to Amnesty International's MVT repository for latest).
- **Network Indicators (Defanged):**
- `nsogroup[.]com`
- `b-gate[.]net`
- `line-tracking[.]com`
- Various randomly generated domains using Cloudfront or other CDNs.
- **Behavioral Indicators:**
- Presence of unauthorized processes such as `bh` or `setframed`.
- Modification of `DataUsage.sqlite` or `netusage.sqlite` files showing spikes in background data transfer.
- Unusual entries in the `com.apple.identityservices.idstatuscache.plist` (iOS).
## Associated Threat Actors
- **NSO Group** (Developer)
- Multiple government and state-sponsored entities worldwide.
## Detection Methods
- **Forensic Backup Analysis:** The most reliable method is using the **Mobile Verification Toolkit (MVT)** to scan an encrypted backup of the device for known Pegasus-linked process names and domain lookups.
- **Behavioral Detection:** Monitoring for unexpected battery drain, device overheating, or sudden increases in data usage (though these are unreliable on their own).
- **Log Inspection:** Analyzing iOS `sysdiag` logs for traces of known exploit names or suspicious crash reports.
## Mitigation Strategies
- **Regular Updates:** Keep iOS and Android operating systems updated to the latest version to patch zero-day vulnerabilities.
- **Device Hardening:** On iOS, use "Lockdown Mode" to significantly reduce the attack surface.
- **Rebooting:** While not a permanent fix, regular reboots can disrupt the persistence of some Pegasus variants that reside in temporary memory.
- **Hardware Replacement:** For confirmed high-value targets, a full firmware restore (DFU mode) or replacing the device is recommended, as standard factory resets may not remove deep-seated infections.
## Related Tools/Techniques
- **Predator (Cytrox)**
- **FinFisher / FinSpy**
- **FORCEDENTRY** (Exploit framework used by Pegasus)